refactor(aibom): use shared vdb-cyclonedx AIBOM format

Move the AIBOM data model + builder out of internal/cdx into vdb-cyclonedx
(v0.2.0): the detector now emits cyclonedx.AIDetections and cmd/aibom.go builds
via cyclonedx.BuildAIBOM(detections, AIBOMOptions{Project}). One implementation
of build/parse/validate shared with vdb-api and vdb-site. Output is unchanged
(verified: CycloneDX 1.7, git metadata, @cf/ Workers AI models + evidence).

Author: 0x73746F66

cmd/aibom.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	cyclonedx "github.com/Vulnetix/vdb-cyclonedx"
 	"github.com/spf13/cobra"
 	"github.com/vulnetix/cli/v3/internal/aibom"
 	"github.com/vulnetix/cli/v3/internal/cdx"
@@ -120,18 +121,15 @@ func runAIBOM(cmd *cobra.Command, args []string) error {
 	}
 
 	// Build the CycloneDX AIBOM once — used both for cyclonedx-json output and
-	// for the backend submission below.
-	ctx := &cdx.ScanContext{
-		Git:         gitctx.Collect(rootPath),
-		System:      gitctx.CollectSystemInfo(),
-		ToolVersion: version,
+	// for the backend submission below. The format (build + validate) lives in
+	// the shared vdb-cyclonedx module so producers and consumers agree.
+	gitCtx := gitctx.Collect(rootPath)
+	bomData, err := cyclonedx.BuildAIBOM(det, cyclonedx.AIBOMOptions{
+		SpecVersion: specVersion,
 		ToolName:    "vulnetix-aibom",
-	}
-	bom, err := cdx.BuildAIBOM(det, specVersion, ctx)
-	if err != nil {
-		return err
-	}
-	bomData, err := bom.MarshalValidatedJSON()
+		ToolVersion: version,
+		Project:     aibomProject(gitCtx, gitctx.CollectSystemInfo()),
+	})
 	if err != nil {
 		return err
 	}
@@ -140,7 +138,7 @@ func runAIBOM(cmd *cobra.Command, args []string) error {
 	// fails the command, and community/unauthenticated callers are skipped (the
 	// server would not persist their data anyway).
 	if !noUpload {
-		uploadAIBOM(specVersion, det, bomData, ctx.Git)
+		uploadAIBOM(specVersion, det, bomData, gitCtx)
 	}
 
 	switch outputFmt {
@@ -184,27 +182,52 @@ func detectAndUploadAIBOM(rootPath string, gitCtx *gitctx.GitContext) {
 	if err != nil || len(det.Tools)+len(det.Libraries)+len(det.Models) == 0 {
 		return
 	}
-	ctx := &cdx.ScanContext{
-		Git:         gitCtx,
-		System:      gitctx.CollectSystemInfo(),
-		ToolVersion: version,
+	data, err := cyclonedx.BuildAIBOM(det, cyclonedx.AIBOMOptions{
+		SpecVersion: "1.7",
 		ToolName:    "vulnetix-aibom",
-	}
-	bom, err := cdx.BuildAIBOM(det, "1.7", ctx)
-	if err != nil {
-		return
-	}
-	data, err := bom.MarshalValidatedJSON()
+		ToolVersion: version,
+		Project:     aibomProject(gitCtx, gitctx.CollectSystemInfo()),
+	})
 	if err != nil {
 		return
 	}
 	uploadAIBOM("1.7", det, data, gitCtx)
 }
 
+// aibomProject maps the CLI's git/system context to the shared AIBOMProject the
+// vdb-cyclonedx builder consumes for metadata.component and git/env properties.
+func aibomProject(g *gitctx.GitContext, sys *gitctx.SystemInfo) *cyclonedx.AIBOMProject {
+	p := &cyclonedx.AIBOMProject{}
+	if g != nil {
+		p.Name = cdx.GitProjectName(g)
+		p.Version = cdx.GitProjectVersion(g)
+		p.Branch = g.CurrentBranch
+		p.Commit = g.CurrentCommit
+		p.CommitTimestamp = g.HeadCommitTimestamp
+		p.CommitMessage = g.HeadCommitMessage
+		p.CommitAuthor = g.HeadCommitAuthor
+		p.CommitEmail = g.HeadCommitEmail
+		p.Tags = g.HeadTags
+		p.IsDirty = g.IsDirty
+		p.IsWorktree = g.IsWorktree
+		p.RepoRoot = g.RepoRootPath
+		p.RemoteURLs = g.RemoteURLs
+		for _, c := range g.RecentCommitters {
+			p.RecentCommitters = append(p.RecentCommitters, cyclonedx.AIBOMContact{Name: c.Name, Email: c.Email})
+		}
+	}
+	if sys != nil {
+		p.System = &cyclonedx.AIBOMSystem{
+			Hostname: sys.Hostname, Shell: sys.Shell, OS: sys.OS, Arch: sys.Arch, Username: sys.Username,
+		}
+	}
+	return p
+}
+
 // uploadAIBOM submits the AIBOM to POST /v2/cli.ai-bom. It is best-effort:
 // community/unauthenticated callers are skipped (the server does not persist
 // their data — see the community no-persist gate) and any error is non-fatal.
-func uploadAIBOM(specVersion string, det cdx.AIDetections, bomData []byte, git *gitctx.GitContext) {
+func uploadAIBOM(specVersion string, det cyclonedx.AIDetections, bomData []byte, git *gitctx.GitContext) {
 	creds, err := auth.LoadCredentials()
 	if err != nil || creds == nil || auth.IsCommunity(creds) {
 		return
@@ -258,7 +281,7 @@ func writeAIBOMOutput(path string, data []byte) error {
 	return nil
 }
 
-func renderAIBOMTable(cmd *cobra.Command, det cdx.AIDetections) error {
+func renderAIBOMTable(cmd *cobra.Command, det cyclonedx.AIDetections) error {
 	dctx := display.FromCommand(cmd)
 	if dctx.IsJSON() {
 		data, err := json.MarshalIndent(det, "", "  ")

go.mod

@@ -4,7 +4,7 @@ go 1.25.0
 
 require (
 	github.com/Masterminds/semver/v3 v3.5.0
-	github.com/Vulnetix/vdb-cyclonedx v0.1.0
+	github.com/Vulnetix/vdb-cyclonedx v0.2.0
 	github.com/alecthomas/chroma/v2 v2.26.1
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10

go.sum

@@ -7,8 +7,8 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
 github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
-github.com/Vulnetix/vdb-cyclonedx v0.1.0 h1:LI/8ypN7MabidtCcjUFCjI5CSG+WS6BfX/FxHGS/1nw=
-github.com/Vulnetix/vdb-cyclonedx v0.1.0/go.mod h1:0YeNSe1jhyjAZdAQ8Atkj8wZj2XzLjVXdu3P6qlTBh8=
+github.com/Vulnetix/vdb-cyclonedx v0.2.0 h1:edCLVlyVchkWIx9vRiST3U6hkrGG/4iHOvVob3NFhL0=
+github.com/Vulnetix/vdb-cyclonedx v0.2.0/go.mod h1:OdwvoW17lbz3CFqBp/csiwZJx7xat1u4zoG6GUEM8U4=
 github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
 github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=

internal/aibom/detect.go

@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/vulnetix/cli/v3/internal/cdx"
+	cdx "github.com/Vulnetix/vdb-cyclonedx"
 	"github.com/vulnetix/cli/v3/internal/sast"
 )
 

internal/aibom/detect_commits.go

@@ -7,7 +7,7 @@ import (
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing/object"
 
-	"github.com/vulnetix/cli/v3/internal/cdx"
+	cdx "github.com/Vulnetix/vdb-cyclonedx"
 )
 
 // defaultCommitScanMax bounds how many commits (from HEAD backwards) the commit

internal/aibom/detect_env.go

@@ -3,7 +3,7 @@ package aibom
 import (
 	"strings"
 
-	"github.com/vulnetix/cli/v3/internal/cdx"
+	cdx "github.com/Vulnetix/vdb-cyclonedx"
 )
 
 // detectEnv records which catalog env-var names are present in the environment.

internal/aibom/detect_files.go

@@ -6,7 +6,7 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/vulnetix/cli/v3/internal/cdx"
+	cdx "github.com/Vulnetix/vdb-cyclonedx"
 	"github.com/vulnetix/cli/v3/internal/sast"
 )
 

internal/aibom/detect_source.go

@@ -1,7 +1,7 @@
 package aibom
 
 import (
-	"github.com/vulnetix/cli/v3/internal/cdx"
+	cdx "github.com/Vulnetix/vdb-cyclonedx"
 	"github.com/vulnetix/cli/v3/internal/sast"
 )
 

internal/aibom/detect_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/vulnetix/cli/v3/internal/cdx"
+	cdx "github.com/Vulnetix/vdb-cyclonedx"
 )
 
 func compiledCatalog(t *testing.T) *CompiledCatalog {